Packet-Marking Scheme for DDoS Attack Prevention K. Stefanidis and D. N. Serpanos University of Patras

Introduction DDoS attacks thrive… Detection works most of the times They cannot be stopped because the sources of the attack are hard to find Unlike most hacking attempts, no response from the victim is required Thus, the source IP address of the attack packets is almost always spoofed Proposed Solutions Ingress filtering Logging Link testing Packet Marking

Goals and Assumptions We need to find a way to filter the packets that are part of a DDoS attack Note: Source IP address can be spoofed We need to find a way to distinguish legitimate from attack packets No additional information except from the packet’s contents should be required No additional packets should be required Attacker may generate any packet Attacker knows that he is being traced Attacker knows the traceback scheme Routing is stable most of the time Routers are not compromised Routers are CPU and Memory limited

Marking Scheme - Overview Packets are marked by all the routers along their path Upon arrival, packets carry a distinct mark that denotes their path A path and a distance field compose the mark Routers <XOR> part of their IP address with existing path field They also increase distance field by one

Marking Procedure We overload part of the fragmentation fields of the IP header The first router along the path initializes the marking The other routers inject their information Scheme is robust against false markings

Filtering and Traceback Detection/Filtering system can use packet markings instead of source IP address for real time filtering Same markings denote same source network What about different paths? Traceback Use the inverse marking procedure to trace the sources of those packets Recursively “visit” upstream routers until you find a source Requires a map of the upstream routers Computational intensive – Can be done “post mortem”

Analysis - Overheads The marking procedure is simple and stateless It produces no bandwidth overhead The amount of information that has to be stored by the victim is limited One 17bit marking per attack source An updated map of upstream routers (< 10 MB)

Analysis - Faults No false negative probability is introduced False positives exist R is the number of edge routers A is the number of attacking hosts n is the number of bits of the marking

Conclusions and Further Work Identifying the true source of incoming packets is the key problem that has to be solved in order to effectively stop DDoS attacks This marking scheme enables Per packet filtering of attack packets Effective traceback Unlike existing marking schemes It is robust against false markings False positives do not rise as attacking hosts increase No additional packets are required for filtering and traceback purposes

Thank you… Any questions?